<!DOCTYPE html>
<html lang="">

<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<meta http-equiv="X-UA-Compatible" content="ie=edge">
<meta itemprop="name" content="elasticsearch&#43;kibana&#43;filebeat搭建">
<meta itemprop="description" content="背景：由于C端用户增多，我们需要有一款针对用户的日志系统，而不是登录容器分析日志，从而提高效率，快速定位问题 分析： 由于在上家公司接触到kibana，对查询语法和使用有一些基本认识，查询资料发现要搭建kibana，需要同时安装elasticsearch和filebeat
 elasticsearch：分布式实时搜索分析引擎，用作全文搜索，结构化搜索和分析搜索，可以用来处理大数据量 kibana：基于web界面，使用户能够直观地查看，分析和可视化存储在elasticsearch中的数据 filebeat：轻量级日志采集器，用于转发和集中日志中的数据  Step1: 安装  使用dockerc-compose 搭建【此处省略docker-compose的安装】
 docker-compose.yml 【注意：elasticsearch和kibana和filebeat最好使用同一个版本】
version: &#39;3.7&#39;services:elasticsearch:image: docker.elastic.co/elasticsearch/elasticsearch:7.17.3 # 使用你需要的版本container_name: elasticsearch-licanenvironment:- node.name=elasticsearch- discovery.type=single-node # 单节点模式，适合测试和开发环境- &#34;xpack.security.enabled=false&#34; # 如果不需要X-Pack安全特性，可以禁用它- &#34;ES_JAVA_OPTS=-Xms512m -Xmx512m&#34; # 设置JVM内存ports:- &#34;9200:9200&#34; # 映射Elasticsearch的HTTP端口到宿主机的9200端口- &#34;9300:9300&#34; # 映射Elasticsearch的TCP传输端口（用于集群节点间的通信）volumes:- data:/usr/share/elasticsearch/data # 将数据保存在一个名为data的卷中，以便在容器停止后数据不会丢失kibana:image: docker.elastic.co/kibana/kibana:7.17.3container_name: kibanaenvironment:- ELASTICSEARCH_HOSTS=http://elasticsearch:9200 - I18N_LOCALE=zh-CN // 配置中文 ports:- &#34;5601:5601&#34;depends_on:- elasticsearchfilebeat:image: docker.">
<meta itemprop="datePublished" content="2024-07-25T10:45:53&#43;08:00" />
<meta itemprop="dateModified" content="2024-07-25T10:45:53&#43;08:00" />
<meta itemprop="wordCount" content="199">



<meta itemprop="keywords" content="" /><meta property="og:title" content="elasticsearch&#43;kibana&#43;filebeat搭建" />
<meta property="og:description" content="背景：由于C端用户增多，我们需要有一款针对用户的日志系统，而不是登录容器分析日志，从而提高效率，快速定位问题 分析： 由于在上家公司接触到kibana，对查询语法和使用有一些基本认识，查询资料发现要搭建kibana，需要同时安装elasticsearch和filebeat
 elasticsearch：分布式实时搜索分析引擎，用作全文搜索，结构化搜索和分析搜索，可以用来处理大数据量 kibana：基于web界面，使用户能够直观地查看，分析和可视化存储在elasticsearch中的数据 filebeat：轻量级日志采集器，用于转发和集中日志中的数据  Step1: 安装  使用dockerc-compose 搭建【此处省略docker-compose的安装】
 docker-compose.yml 【注意：elasticsearch和kibana和filebeat最好使用同一个版本】
version: &#39;3.7&#39;services:elasticsearch:image: docker.elastic.co/elasticsearch/elasticsearch:7.17.3 # 使用你需要的版本container_name: elasticsearch-licanenvironment:- node.name=elasticsearch- discovery.type=single-node # 单节点模式，适合测试和开发环境- &#34;xpack.security.enabled=false&#34; # 如果不需要X-Pack安全特性，可以禁用它- &#34;ES_JAVA_OPTS=-Xms512m -Xmx512m&#34; # 设置JVM内存ports:- &#34;9200:9200&#34; # 映射Elasticsearch的HTTP端口到宿主机的9200端口- &#34;9300:9300&#34; # 映射Elasticsearch的TCP传输端口（用于集群节点间的通信）volumes:- data:/usr/share/elasticsearch/data # 将数据保存在一个名为data的卷中，以便在容器停止后数据不会丢失kibana:image: docker.elastic.co/kibana/kibana:7.17.3container_name: kibanaenvironment:- ELASTICSEARCH_HOSTS=http://elasticsearch:9200 - I18N_LOCALE=zh-CN // 配置中文 ports:- &#34;5601:5601&#34;depends_on:- elasticsearchfilebeat:image: docker." />
<meta property="og:type" content="article" />
<meta property="og:url" content="https://www.lican.site/postsbak/elasticsearch&#43;kibana&#43;filebeat%E6%90%AD%E5%BB%BA/" />
<meta property="article:published_time" content="2024-07-25T10:45:53+08:00" />
<meta property="article:modified_time" content="2024-07-25T10:45:53+08:00" />
<meta name="twitter:card" content="summary"/>
<meta name="twitter:title" content="elasticsearch&#43;kibana&#43;filebeat搭建"/>
<meta name="twitter:description" content="背景：由于C端用户增多，我们需要有一款针对用户的日志系统，而不是登录容器分析日志，从而提高效率，快速定位问题 分析： 由于在上家公司接触到kibana，对查询语法和使用有一些基本认识，查询资料发现要搭建kibana，需要同时安装elasticsearch和filebeat
 elasticsearch：分布式实时搜索分析引擎，用作全文搜索，结构化搜索和分析搜索，可以用来处理大数据量 kibana：基于web界面，使用户能够直观地查看，分析和可视化存储在elasticsearch中的数据 filebeat：轻量级日志采集器，用于转发和集中日志中的数据  Step1: 安装  使用dockerc-compose 搭建【此处省略docker-compose的安装】
 docker-compose.yml 【注意：elasticsearch和kibana和filebeat最好使用同一个版本】
version: &#39;3.7&#39;services:elasticsearch:image: docker.elastic.co/elasticsearch/elasticsearch:7.17.3 # 使用你需要的版本container_name: elasticsearch-licanenvironment:- node.name=elasticsearch- discovery.type=single-node # 单节点模式，适合测试和开发环境- &#34;xpack.security.enabled=false&#34; # 如果不需要X-Pack安全特性，可以禁用它- &#34;ES_JAVA_OPTS=-Xms512m -Xmx512m&#34; # 设置JVM内存ports:- &#34;9200:9200&#34; # 映射Elasticsearch的HTTP端口到宿主机的9200端口- &#34;9300:9300&#34; # 映射Elasticsearch的TCP传输端口（用于集群节点间的通信）volumes:- data:/usr/share/elasticsearch/data # 将数据保存在一个名为data的卷中，以便在容器停止后数据不会丢失kibana:image: docker.elastic.co/kibana/kibana:7.17.3container_name: kibanaenvironment:- ELASTICSEARCH_HOSTS=http://elasticsearch:9200 - I18N_LOCALE=zh-CN // 配置中文 ports:- &#34;5601:5601&#34;depends_on:- elasticsearchfilebeat:image: docker."/>

	<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
	<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
	<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
	<link rel="manifest" href="/site.webmanifest">
	<link rel="mask-icon" href="/safari-pinned-tab.svg" color="">
	<link rel="shortcut icon" href="/favicon.ico">

	<title>elasticsearch&#43;kibana&#43;filebeat搭建</title>
	<link rel="stylesheet" href="https://www.lican.site/css/style.min.d3141168199607bf3a517216ce3c263814eecdbc8fca72a9a88700799a838219.css">
	
</head>

<body id="page">
	
	<header id="site-header" class="animated slideInUp faster">
		<div class="hdr-wrapper section-inner">
			<div class="hdr-left">
				<div class="site-branding">
					<a href="https://www.lican.site">花落雨忧</a>
				</div>
				<nav class="site-nav hide-in-mobile">
					<a href="https://www.lican.site/posts">首页</a>
					<a href="https://www.lican.site/tech/">技术文档</a>
					<a href="https://www.lican.site/article/">文章</a>
					<a href="https://www.lican.site/project/">项目</a>
					<a href="https://www.lican.site/about/">关于</a>
				</nav>
			</div>
			<div class="hdr-right hdr-icons">
				<button id="menu-btn" class="hdr-btn" title="Menu"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-menu"><line x1="3" y1="12" x2="21" y2="12"></line><line x1="3" y1="6" x2="21" y2="6"></line><line x1="3" y1="18" x2="21" y2="18"></line></svg></button>
			</div>
		</div>
	</header>
	<div id="mobile-menu" class="animated fast">
		<ul>
			<li><a href="https://www.lican.site/posts">首页</a></li>
			<li><a href="https://www.lican.site/tech/">技术文档</a></li>
			<li><a href="https://www.lican.site/article/">文章</a></li>
			<li><a href="https://www.lican.site/project/">项目</a></li>
			<li><a href="https://www.lican.site/about/">关于</a></li>
		</ul>
	</div>


	<main class="site-main section-inner thin animated fadeIn faster">
		<h1>elasticsearch&#43;kibana&#43;filebeat搭建</h1>
		<div class="content">
			<h4 id="背景由于c端用户增多我们需要有一款针对用户的日志系统而不是登录容器分析日志从而提高效率快速定位问题">背景：由于C端用户增多，我们需要有一款针对用户的日志系统，而不是登录容器分析日志，从而提高效率，快速定位问题<a href="#背景由于c端用户增多我们需要有一款针对用户的日志系统而不是登录容器分析日志从而提高效率快速定位问题" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path><line x1="8" y1="12" x2="16" y2="12"></line></svg></a></h4>
<p>分析： 由于在上家公司接触到kibana，对查询语法和使用有一些基本认识，查询资料发现要搭建kibana，需要同时安装elasticsearch和filebeat</p>
<ul>
<li>elasticsearch：分布式实时搜索分析引擎，用作全文搜索，结构化搜索和分析搜索，可以用来处理大数据量</li>
<li>kibana：基于web界面，使用户能够直观地查看，分析和可视化存储在elasticsearch中的数据</li>
<li>filebeat：轻量级日志采集器，用于转发和集中日志中的数据</li>
</ul>
<h5 id="step1-安装">Step1: 安装<a href="#step1-安装" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path><line x1="8" y1="12" x2="16" y2="12"></line></svg></a></h5>
<blockquote>
<p>使用dockerc-compose 搭建【此处省略docker-compose的安装】</p>
</blockquote>
<p>docker-compose.yml 【注意：elasticsearch和kibana和filebeat最好使用同一个版本】</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-go" data-lang="go">
<span style="color:#a6e22e">version</span>: <span style="color:#960050;background-color:#1e0010">&#39;</span><span style="color:#ae81ff">3.7</span><span style="color:#960050;background-color:#1e0010">&#39;</span>
<span style="color:#a6e22e">services</span>:
  <span style="color:#a6e22e">elasticsearch</span>:
    <span style="color:#a6e22e">image</span>: <span style="color:#a6e22e">docker</span>.<span style="color:#a6e22e">elastic</span>.<span style="color:#a6e22e">co</span><span style="color:#f92672">/</span><span style="color:#a6e22e">elasticsearch</span><span style="color:#f92672">/</span><span style="color:#a6e22e">elasticsearch</span>:<span style="color:#ae81ff">7.17.3</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">使用你需要的版本</span>
    <span style="color:#a6e22e">container_name</span>: <span style="color:#a6e22e">elasticsearch</span><span style="color:#f92672">-</span><span style="color:#a6e22e">lican</span>
    <span style="color:#a6e22e">environment</span>:
      <span style="color:#f92672">-</span> <span style="color:#a6e22e">node</span>.<span style="color:#a6e22e">name</span>=<span style="color:#a6e22e">elasticsearch</span>
      <span style="color:#f92672">-</span> <span style="color:#a6e22e">discovery</span>.<span style="color:#66d9ef">type</span>=<span style="color:#a6e22e">single</span><span style="color:#f92672">-</span><span style="color:#a6e22e">node</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">单节点模式</span><span style="color:#960050;background-color:#1e0010">，</span><span style="color:#a6e22e">适合测试和开发环境</span>
      <span style="color:#f92672">-</span> <span style="color:#e6db74">&#34;xpack.security.enabled=false&#34;</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">如果不需要X</span><span style="color:#f92672">-</span><span style="color:#a6e22e">Pack安全特性</span><span style="color:#960050;background-color:#1e0010">，</span><span style="color:#a6e22e">可以禁用它</span>
      <span style="color:#f92672">-</span> <span style="color:#e6db74">&#34;ES_JAVA_OPTS=-Xms512m -Xmx512m&#34;</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">设置JVM内存</span>
    <span style="color:#a6e22e">ports</span>:
      <span style="color:#f92672">-</span> <span style="color:#e6db74">&#34;9200:9200&#34;</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">映射Elasticsearch的HTTP端口到宿主机的9200端口</span>
      <span style="color:#f92672">-</span> <span style="color:#e6db74">&#34;9300:9300&#34;</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">映射Elasticsearch的TCP传输端口</span><span style="color:#960050;background-color:#1e0010">（</span><span style="color:#a6e22e">用于集群节点间的通信</span><span style="color:#960050;background-color:#1e0010">）</span>
    <span style="color:#a6e22e">volumes</span>:
      <span style="color:#f92672">-</span> <span style="color:#a6e22e">data</span>:<span style="color:#f92672">/</span><span style="color:#a6e22e">usr</span><span style="color:#f92672">/</span><span style="color:#a6e22e">share</span><span style="color:#f92672">/</span><span style="color:#a6e22e">elasticsearch</span><span style="color:#f92672">/</span><span style="color:#a6e22e">data</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">将数据保存在一个名为data的卷中</span><span style="color:#960050;background-color:#1e0010">，</span><span style="color:#a6e22e">以便在容器停止后数据不会丢失</span>

  <span style="color:#a6e22e">kibana</span>:
    <span style="color:#a6e22e">image</span>: <span style="color:#a6e22e">docker</span>.<span style="color:#a6e22e">elastic</span>.<span style="color:#a6e22e">co</span><span style="color:#f92672">/</span><span style="color:#a6e22e">kibana</span><span style="color:#f92672">/</span><span style="color:#a6e22e">kibana</span>:<span style="color:#ae81ff">7.17.3</span>
    <span style="color:#a6e22e">container_name</span>: <span style="color:#a6e22e">kibana</span>
    <span style="color:#a6e22e">environment</span>:
      <span style="color:#f92672">-</span> <span style="color:#a6e22e">ELASTICSEARCH_HOSTS</span>=<span style="color:#a6e22e">http</span>:<span style="color:#75715e">//elasticsearch:9200
</span><span style="color:#75715e"></span>      <span style="color:#f92672">-</span> <span style="color:#a6e22e">I18N_LOCALE</span>=<span style="color:#a6e22e">zh</span><span style="color:#f92672">-</span><span style="color:#a6e22e">CN</span> <span style="color:#75715e">// 配置中文
</span><span style="color:#75715e"></span>    <span style="color:#a6e22e">ports</span>:
      <span style="color:#f92672">-</span> <span style="color:#e6db74">&#34;5601:5601&#34;</span>
    <span style="color:#a6e22e">depends_on</span>:
      <span style="color:#f92672">-</span> <span style="color:#a6e22e">elasticsearch</span>

  <span style="color:#a6e22e">filebeat</span>:
    <span style="color:#a6e22e">image</span>: <span style="color:#a6e22e">docker</span>.<span style="color:#a6e22e">elastic</span>.<span style="color:#a6e22e">co</span><span style="color:#f92672">/</span><span style="color:#a6e22e">beats</span><span style="color:#f92672">/</span><span style="color:#a6e22e">filebeat</span>:<span style="color:#ae81ff">7.17.3</span>
    <span style="color:#a6e22e">container_name</span>: <span style="color:#a6e22e">filebeat</span>
    <span style="color:#a6e22e">user</span>: <span style="color:#e6db74">&#34;root&#34;</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">可能需要root权限来读取日志文件</span>
    <span style="color:#a6e22e">volumes</span>:
      <span style="color:#f92672">-</span> .<span style="color:#f92672">/</span><span style="color:#a6e22e">filebeat</span>.<span style="color:#a6e22e">yml</span>:<span style="color:#f92672">/</span><span style="color:#a6e22e">usr</span><span style="color:#f92672">/</span><span style="color:#a6e22e">share</span><span style="color:#f92672">/</span><span style="color:#a6e22e">filebeat</span><span style="color:#f92672">/</span><span style="color:#a6e22e">filebeat</span>.<span style="color:#a6e22e">yml</span>:<span style="color:#a6e22e">ro</span> <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">配置文件</span>
      <span style="color:#f92672">-</span> <span style="color:#f92672">/</span><span style="color:#66d9ef">var</span><span style="color:#f92672">/</span><span style="color:#a6e22e">log</span>:<span style="color:#f92672">/</span><span style="color:#66d9ef">var</span><span style="color:#f92672">/</span><span style="color:#a6e22e">log</span>:<span style="color:#a6e22e">ro</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">假设你的日志文件在</span><span style="color:#f92672">/</span><span style="color:#66d9ef">var</span><span style="color:#f92672">/</span><span style="color:#a6e22e">log目录下</span>
      <span style="color:#f92672">-</span> <span style="color:#f92672">/</span><span style="color:#a6e22e">data</span><span style="color:#f92672">/</span><span style="color:#a6e22e">docker</span><span style="color:#f92672">/</span><span style="color:#a6e22e">containers</span>:<span style="color:#f92672">/</span><span style="color:#a6e22e">docker</span><span style="color:#f92672">/</span> <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">映射目录</span>
    <span style="color:#a6e22e">depends_on</span>:
      <span style="color:#f92672">-</span> <span style="color:#a6e22e">elasticsearch</span>

<span style="color:#a6e22e">volumes</span>:
  <span style="color:#a6e22e">data</span>:
    <span style="color:#a6e22e">driver</span>: <span style="color:#a6e22e">local</span>

</code></pre></div><p>配置好编排文件后，启动</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-go" data-lang="go"><span style="color:#a6e22e">docker</span><span style="color:#f92672">-</span><span style="color:#a6e22e">compose</span> <span style="color:#a6e22e">up</span> <span style="color:#f92672">-</span><span style="color:#a6e22e">d</span>;  <span style="color:#75715e">// -d：后台启动
</span><span style="color:#75715e"></span><span style="color:#a6e22e">docker</span><span style="color:#f92672">-</span><span style="color:#a6e22e">compose</span> <span style="color:#a6e22e">ps</span>; <span style="color:#75715e">// 查询运行状态
</span></code></pre></div><p>当发现以下界面，表示安装并启动成功</p>
<p><img src="https://www.lican.site/images/elasticsearch/1.png" alt="1721874295334"></p>
<p>打开浏览器，通过服务器ip:端口访问，查看服务运行状态【请配置服务器端口的安全组】</p>
<p>访问http://localhost:9200，出现以下界面，表示elasticsearch运行成功</p>
<p><img src="https://www.lican.site/images/elasticsearch/2.png" alt="1721874424161"></p>
<p>访问http://localhost:5601，出现以下界面，表示kibana运行成功</p>
<p><img src="https://www.lican.site/images/elasticsearch/4.png" alt="1721874484318"></p>
<h5 id="step2-filebeat采集日志">Step2: filebeat采集日志<a href="#step2-filebeat采集日志" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path><line x1="8" y1="12" x2="16" y2="12"></line></svg></a></h5>
<blockquote>
<p>配置filebeat.yml 配置文件</p>
</blockquote>
<p>在dockerc-compose.yml文件中配置了filebeat的挂载目录，配置的是当前目录映射镜像内配置文件目录</p>
<ul>
<li>./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro # 配置文件</li>
</ul>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-go" data-lang="go"><span style="color:#a6e22e">filebeat</span>.<span style="color:#a6e22e">inputs</span>:

<span style="color:#f92672">-</span> <span style="color:#66d9ef">type</span>: <span style="color:#a6e22e">log</span>
  <span style="color:#a6e22e">enabled</span>: <span style="color:#66d9ef">true</span>
  <span style="color:#a6e22e">paths</span>:
    <span style="color:#f92672">-</span> <span style="color:#f92672">/</span><span style="color:#66d9ef">var</span><span style="color:#f92672">/</span><span style="color:#a6e22e">log</span><span style="color:#f92672">/*</span>.<span style="color:#a6e22e">log</span>  <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">读取</span><span style="color:#f92672">/</span><span style="color:#66d9ef">var</span><span style="color:#f92672">/</span><span style="color:#a6e22e">log目录下的所有</span>.<span style="color:#a6e22e">log文件</span>
  <span style="color:#a6e22e">fields</span>:
    <span style="color:#a6e22e">log_source</span>: <span style="color:#a6e22e">filebeat_container</span>
  <span style="color:#a6e22e">tags</span>: [<span style="color:#e6db74">&#34;system_log&#34;</span>]

<span style="color:#f92672">-</span> <span style="color:#66d9ef">type</span>: <span style="color:#a6e22e">log</span>
  <span style="color:#a6e22e">enabled</span>: <span style="color:#66d9ef">true</span>
  <span style="color:#a6e22e">paths</span>:
    <span style="color:#f92672">-</span> <span style="color:#f92672">/</span><span style="color:#a6e22e">docker</span><span style="color:#f92672">/</span><span style="color:#ae81ff">6</span><span style="color:#a6e22e">a53835ee69299075330327bd4bb712b69cf7f55a382a6647ba631d40d335321</span><span style="color:#f92672">/*</span>.<span style="color:#a6e22e">log</span> <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">系统日志</span>
  <span style="color:#a6e22e">fields</span>:
    <span style="color:#a6e22e">log_type</span>: <span style="color:#a6e22e">system</span>
  <span style="color:#a6e22e">tags</span>: [<span style="color:#e6db74">&#34;brewing-bigdata&#34;</span>]

<span style="color:#a6e22e">setup</span>.<span style="color:#a6e22e">template</span>.<span style="color:#a6e22e">name</span>: <span style="color:#e6db74">&#34;filebeat-%{[agent.version]}&#34;</span>
<span style="color:#a6e22e">setup</span>.<span style="color:#a6e22e">template</span>.<span style="color:#a6e22e">pattern</span>: <span style="color:#e6db74">&#34;filebeat-%{[agent.version]}-*&#34;</span>
<span style="color:#ae81ff">3</span><span style="color:#a6e22e">setup</span>.<span style="color:#a6e22e">template</span>.<span style="color:#a6e22e">json</span>.<span style="color:#a6e22e">sha1</span>: <span style="color:#e6db74">&#34;&#34;</span> <span style="color:#960050;background-color:#1e0010">#</span> <span style="color:#a6e22e">可选</span><span style="color:#960050;background-color:#1e0010">，</span><span style="color:#a6e22e">如果你知道模板文件的SHA1哈希值</span>

<span style="color:#a6e22e">output</span>.<span style="color:#a6e22e">elasticsearch</span>:
  <span style="color:#a6e22e">hosts</span>: [<span style="color:#e6db74">&#34;http://120.79.80.2:9200&#34;</span>]
  <span style="color:#a6e22e">indices</span>:
    <span style="color:#f92672">-</span> <span style="color:#a6e22e">index</span>: <span style="color:#e6db74">&#34;system_log-%{[agent.version]}-%{+yyyy.MM.dd}&#34;</span>
      <span style="color:#a6e22e">when</span>.<span style="color:#a6e22e">contains</span>:
        <span style="color:#a6e22e">tags</span>: <span style="color:#e6db74">&#34;system_log&#34;</span>
    <span style="color:#f92672">-</span> <span style="color:#a6e22e">index</span>: <span style="color:#e6db74">&#34;brewing_bigdata-%{[agent.version]}-%{+yyyy.MM.dd}&#34;</span>
      <span style="color:#a6e22e">when</span>.<span style="color:#a6e22e">contains</span>:
        <span style="color:#a6e22e">tags</span>: <span style="color:#e6db74">&#34;brewing-bigdata&#34;</span>

<span style="color:#a6e22e">setup</span>.<span style="color:#a6e22e">kibana</span>:
  <span style="color:#a6e22e">host</span>: <span style="color:#e6db74">&#34;kibana:5601&#34;</span>
</code></pre></div><p>配置文件的inputs和outputs为设置索引并关联采集日志目录的地方，可以为多组，配置完成后，重启服务</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-go" data-lang="go"><span style="color:#a6e22e">docker</span><span style="color:#f92672">-</span><span style="color:#a6e22e">compose</span> <span style="color:#a6e22e">down</span>;<span style="color:#a6e22e">docker</span><span style="color:#f92672">-</span><span style="color:#a6e22e">compose</span> <span style="color:#a6e22e">up</span> <span style="color:#f92672">-</span><span style="color:#a6e22e">d</span>;
</code></pre></div><p>在服务器上执行 docker logs -f -n 100 filebeat 查看运行日志，无明显错误，表示filebeat运行成功</p>
<p><img src="https://www.lican.site/images/elasticsearch/5.png" alt="1721874556697"></p>
<h5 id="step3-关联elasticsearch和filebeat索引">Step3: 关联elasticsearch和filebeat索引<a href="#step3-关联elasticsearch和filebeat索引" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path><line x1="8" y1="12" x2="16" y2="12"></line></svg></a></h5>
<blockquote>
<p>由于配置的filebeat索引是一个动态索引，日志采集后，需要进入elastcisearch中进行关联</p>
</blockquote>
<p>访问 http://localhost:5601</p>
<p><img src="https://www.lican.site/images/elasticsearch/6.png" alt="1721875044228"></p>
<p><img src="https://www.lican.site/images/elasticsearch/7.png" alt="1721875068193"></p>
<p><img src="https://www.lican.site/images/elasticsearch/8.png" alt="1721875093407"></p>
<p><img src="https://www.lican.site/images/elasticsearch/9.png" alt="1721875240450"></p>
<p>创建完成之后，就可以在索引栏这里更换索引了，查看filebeat在对应日志目录中采集到的日志啦~</p>
<p><img src="https://www.lican.site/images/elasticsearch/10.png" alt="1721875321266"></p>
<p>此时，我就可以使用KQL语法搜索日志了</p>
<p><img src="https://www.lican.site/images/elasticsearch/11.png" alt="1721875405540"></p>

		</div>
	</main>

	<footer id="site-footer" class="section-inner thin animated fadeIn faster">
		<p>&copy; 2024 <a href="https://www.lican.site"></a></p>
		<p>
			Made with <a href="https://gohugo.io/" target="_blank" rel="noopener">Hugo</a> &#183; Theme <a href="https://github.com/Track3/hermit" target="_blank" rel="noopener">Hermit</a> &#183; <a href="https://www.lican.site/post/index.xml" target="_blank" title="rss"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-rss"><path d="M4 11a9 9 0 0 1 9 9"></path><path d="M4 4a16 16 0 0 1 16 16"></path><circle cx="5" cy="19" r="1"></circle></svg></a>
		</p>
	</footer>


	<script src="https://www.lican.site/js/main.min.784417f5847151f848c339cf0acb13a06cbb648b1483435a28ed4556c4ead69b.js"></script>

</body>

</html>
